dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips)
1.28-debian-fips, 1.28-debian13-fips, 1.28-fips, 1.28.4-debian-fips, 1.28.4-debian13-fips, 1.28.4-fips
sha256:3a7d1436e764726ea0f2d022df52d97fe98f2e9363bb7ef9447089ef52faaa6a
Manifest digest:sha256:461da9690f8e002f71c6ca5c1bd64842c62c6f9177196c4984fa9ffecaea8172
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:573e4e98aa11ccee66b9ab3ae0d842fe48cfe83f074a829e3b5c807b1e78ad91 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:7b67d0f3260488ddf0dec8f87fab5a04530d80d92991311a18bfa11267c92c37 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:c7f6f0dd0574151bf9d2c860bc00406fdb3b4f32bb0d04e74535e83f7d40d52e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e4f6c7e61613c48a00a9928958ed16bd44a04c63b9afd4c8de492490fab4c660 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:473035079a41d48b9e4b269b877757698a3b8872b140a591bfc5e0a87b0416bf |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:901bb8409aa981577572d29b4589fb970f6612a13335a412124de16667df39c2 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:517efda2ff5dc80aef5acf0466d92699140b1b16cf88498f2ca211c16ea1fd97 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:892febf11e109ccfd8fbb0eb0c6c184649ccd6472080d25794d6b912fc78669a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:47b80bc4556e622ee7b1252c803308dce4500f8af7b9c1ef66f456acd05c73b1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:1d4bb14ef81debf63af9d35dfc7ae4fb129da24d8c88d6d93e864073cb201387 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:946f4276666594be3f82b4bce9e2d1dc8d35d058991fd716de04a7ccb245dcf5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:df585f801ef4599b3a687e6ac536edb2bcc659044f06db9112dc666fd794e073 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a727b09554a5c91fa76f44e87e70c278ea7f5947a3722fdf76260cfd93175489 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:23605773a72ac4b793ffe28d7e38da309a78af6b568bfa1a8a836e35ca04033b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:5a505ba5a703630e01bcd0fd798e7c8e5dfb0e8c55201e5252999818db0c3ddc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:f9dbf99db76e3d0e3aa4dd81b6c5133f8ce1ed097f0098584a124c9e3c5c5eb1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:8aaa5eea7927c5fe8908f18ae9db93aff0508237c44099bc09571dc1a871a6ff |